Nassim Taleb & Cyber Security | Risk, Antifragility & the Incerto
From The Black Swan to Skin in the Game – Taleb’s Incerto series is the most useful framework for cyber risk most business owners have never read.
What Nassim Nicholas Taleb can teach us about cyber risk
Some of the most useful thinking about cyber security does not come from a security textbook. It comes from a former options trader who spent years watching people misunderstand chance, uncertainty and the cost of being wrong.
Who Is Nassim Nicholas Taleb?
Nassim Nicholas Taleb is a Lebanese-American scholar, former derivatives trader, and professor of risk engineering at New York University. Born in 1960, he spent years working on trading floors before turning to writing and academia - an experience that shaped everything he went on to argue.
His central observation, drawn from years of watching financial markets, is that human beings are systematically bad at understanding uncertainty. We overestimate our ability to predict events, underestimate the role of randomness in outcomes we think we caused, and build models of the world that are dangerously fragile when reality turns out differently from our expectations.
He began publishing the Incerto - his five-book series on uncertainty, risk, and probability, in 2001. The Sunday Times described The Black Swan as one of the twelve most influential books since the Second World War. His work is cited across finance, economics, medicine, military strategy, and increasingly, cyber security.
He is not a cyber security expert. He has never written specifically about cyber risk. But the frameworks he developed for understanding rare, high-impact events translate to the domain with almost uncomfortable precision - which is part of what makes the Incerto so useful for anyone thinking seriously about organisational risk.
Cyber security is not just a technology problem. It is a risk problem.
Taleb’s Incerto series is one of the clearest bodies of work on uncertainty, rare events, bad incentives and fragile systems. It is not written for cyber security, but the fit is hard to ignore.
Businesses often ask the wrong cyber questions. “Have we been hacked before?” “Do we have antivirus?” “Are we compliant?” Useful questions go further: what could ruin us, how would we know, have we tested it, and who carries the cost if the advice turns out to be wrong?
The Incerto, translated into cyber security
Five books. Five useful ways to think about cyber risk, resilience and the uncomfortable gap between what we think we know and what we have actually tested.
Fooled by Randomness
The Hidden Role of Chance in Life and in the Markets
Taleb’s first book makes a point many businesses need to hear: we often confuse luck with skill. When things go well, we build a neat story explaining why success was inevitable. The failed versions of the same story are usually invisible.
The absence of a known incident is not the same as the absence of an incident. Attackers can sit quietly inside systems before acting. The business may look calm from the outside while the risk is already building.
Question to ask: how many parallel versions of your business, making the same security choices, would still be fine?
The Black Swan
The Impact of the Highly Improbable
This is one of the books that inspired the name Black Swan Cyber Security Solutions (alongside Never Split the Difference). Taleb’s point is not that rare events can be neatly predicted. It is that we are often poor at judging their likelihood and terrible at preparing for their impact.
For a smaller organisation, a serious ransomware attack does not need to make international headlines. It only needs to stop work, damage trust, expose data, or prove that the backups were not recoverable.
Question to ask: what is the worst realistic cyber event that could happen to your organisation, and have you planned for it?
The Bed of Procrustes
Philosophical and Practical Aphorisms
The title comes from the myth of Procrustes, who made travellers fit his bed by stretching or cutting them. Taleb uses this as a warning about forcing reality to fit the model we already prefer.
A backup strategy that has never been tested is still theoretical. A phishing policy that has never been tested against real behaviour is still an assumption. A security stack that nobody reviews can become a comfort blanket rather than a control.
Question to ask: are you measuring what actually reduces risk, or what is easiest to report?
Antifragile
Things That Gain from Disorder
Fragile things break under stress. Resilient things recover. Antifragile things improve because they are tested, stressed and adapted in controlled ways.
Layered security helps because the failure of one control does not have to become total failure. A blocked phishing attempt, a detected login anomaly, or a contained malware alert can become useful evidence that improves the whole security posture.
Question to ask: when did you last test what would actually happen during a cyber incident?
Skin in the Game
Hidden Asymmetries in Daily Life
Taleb’s final book in the series focuses on incentives. Advice changes when the person giving it shares the consequences if it turns out to be wrong.
This matters in cyber security because poor advice can leave the client carrying all the risk. Tools, policies and compliance paperwork are only useful when they are properly chosen, configured, monitored and tested.
Question to ask: does your current provider have genuine skin in the game, or just a contract?
The Incerto as a cyber risk framework
You do not need to become a philosopher of probability to use the ideas. You just need to ask better questions.
Fooled by Randomness
Do not confuse a quiet period with safety. Luck can look like good judgement until it runs out.
The Black Swan
Plan for the damaging event, not just the everyday nuisance. Tail risk matters.
The Bed of Procrustes
Measure what matters. Do not force cyber risk into neat reports that hide the real issue.
Antifragile
Use controlled stress: testing, simulations, reviews and recovery checks.
Skin in the Game
Scrutinise advice where the adviser carries no cost if the recommendation fails.
Which Taleb book should you read first?
If you are reading this from a cyber security angle, these three are the best starting points.
Disclosure: the book links on this page are affiliate links. If you buy through them, Black Swan Cyber Security Solutions may receive a small commission at no extra cost to you.
The Black Swan
The natural starting point, especially if you want to understand rare, high-impact events.
Antifragile
The most useful for thinking about testing, resilience and becoming stronger under stress.
Skin in the Game
The sharpest lens for judging advice, incentives and provider accountability.
Part of the books that shaped Black Swan collection
Nassim Nicholas Taleb’s work is one of several influences that helped shape how Black Swan Cyber Security Solutions thinks about risk, resilience, trust and practical cyber security advice.
You can also read how Chris Voss’s negotiation principles connect to ransomware and incident response, how Marcus Sheridan shaped our trust-first content approach, and how Daniel Priestley’s ideas apply to visibility and accountability in cyber security.
Want to test your own assumptions?
If this has made you wonder whether your backups are proven, your controls are monitored, your staff are prepared, or your current provider has real skin in the game, we can help you get a clear picture.